From 20726c9b4dc04df450d92c43d1e57a343b739c63 Mon Sep 17 00:00:00 2001
From: dipup <dipup@paasup.io>
Date: Wed, 23 Sep 2026 11:47:41 +0900
Subject: [PATCH] feat: starrocks FE service LoadBalancer (shared apisix IP,
 AWS/office allowlist)

---
 manifests/helm/starrocks/1.11.3-4.0.0/dip-values.yaml | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/manifests/helm/starrocks/1.11.3-4.0.0/dip-values.yaml b/manifests/helm/starrocks/1.11.3-4.0.0/dip-values.yaml
index 989f26c..60c7227 100644
--- a/manifests/helm/starrocks/1.11.3-4.0.0/dip-values.yaml
+++ b/manifests/helm/starrocks/1.11.3-4.0.0/dip-values.yaml
@@ -13,7 +13,15 @@ starrocksFESpec:
   replicas: 1
   runAsNonRoot: "false"
   service:
-    type: ClusterIP
+    type: LoadBalancer
+    # apisix 게이트웨이가 쓰는 정적 IP를 그대로 재사용한다 — 80/443과 포트가 겹치지 않아
+    # 같은 GCP 정적 IP에 별도 forwarding rule로 공존 가능(신규 IP 예약 불필요).
+    loadbalancerIP: "34.64.109.9"
+    # AWS 연동 + 사무실 접근만 허용 (그 외 인터넷 전체 차단)
+    loadBalancerSourceRanges:
+      - "13.124.10.134/32"
+      - "43.200.81.130/32"
+      - "125.141.12.182/32"
   resources:
     requests:
       cpu: 300m